Attorneys general for 39 states and the District of Columbia today filed a 28-page notice in the US Bankruptcy Court for the District of Delaware warning the court, Character Technologies and any potential buyer that the sale of the Character.ai chatbot app or its user data will have to meet nine regulatory conditions. They include effective age checks, removal of characters posing as therapists, doctors and lawyers, a ban on training models on chat content beyond what users consented to, and advertising opt-outs that work at the account level rather than device by device. The coalition reserved the right to object to the sale, to the bidding procedures or to any plan, and to ask for a consumer privacy ombudsman.

In Short

Forty state and district law enforcement offices told the bankruptcy judge that whoever buys Character.ai, or the conversations people had on it, has to follow their consumer protection and privacy rules. You might have told a chatbot "therapist" things you would only tell a real doctor, and the states say millions of those users were children whose data may be filed as adult data. The states listed nine things they want from any buyer and kept the right to fight the sale if those things are missing.

What was filed today

The document is Docket No. 33 in case 26-11603 (BLS), In re Character Technologies, Inc., the Chapter 11 case before Judge Brendan L. Shannon that the company opened on October 12, 2026. It is titled "Notice of Interest and Reservation of Rights by the Coalition of the State Attorneys General Regarding the Debtor's Outstanding Regulatory, Safety, and Privacy Issues." It is dated October 14, 2026, and its certificate of service says it was served the same day through the court's electronic filing system on all parties requesting notice.

It runs to 28 pages, and three exhibits push the filing past 300 pages in total:

  • Exhibit A: the complaint Kentucky filed against Character Technologies and its co-founders in Franklin Circuit Court on January 8, 2026 (No. 26-CI-00029), 52 pages
  • Exhibit B: the petition filed by Pennsylvania's State Board of Medicine in the Commonwealth Court of Pennsylvania on May 1, 2026 (220 MD 2026), 14 pages
  • Exhibit C: the December 9, 2024 complaint in A.F. v. Character Technologies in the Eastern District of Texas, which also names Noam Shazeer, Daniel De Freitas Adiwarsana, Google LLC and Alphabet Inc., 243 pages including its own exhibits

The pages of Exhibit A in the court copy reviewed for this article are scanned images without a readable text layer, so the Kentucky complaint is described here only through what the notice itself quotes from it. Those pages carry a Franklin Circuit Clerk stamp dated October 7, 2026, a week before today's filing; the notice does not explain the date.

The filing's stated purpose is narrow. According to the notice, the states act "out of an abundance of caution and to put all parties on notice of the regulatory issues that will need to be addressed in any sale or transfer of the Debtor's business or assets." They cite "the highly sensitive nature of the conversations many users have with Character.AI chatbot characters, the large number of minors who use the product, the serious risks posed by specific features of the product, and the speed at which bankruptcy cases progress."

That last point matters. The bidding calendar the company proposed puts the bid deadline at November 20, an auction on November 23 and the sale hearing on November 24, with Disney's outside date on December 17, as PPC Land reported when the bidding procedures and Disney's term sheet were filed. Six weeks is not long for 40 regulators to coordinate a position on a sale.

Who signed, and who did not

The coalition is broad and bipartisan. Abigail Rushing Ryan, bankruptcy counsel at the National Association of Attorneys General in Washington, signed for 36 of the jurisdictions: Alaska, Arkansas, California, Colorado, Connecticut, the District of Columbia, Delaware, Georgia, Hawaii, Idaho, Illinois, Indiana, Kansas, Kentucky, Louisiana, Maine, Michigan, Minnesota, Mississippi, Nevada, New Hampshire, New York, North Carolina, North Dakota, Ohio, Oklahoma, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Vermont, Virginia, Washington, Wisconsin and West Virginia.

Separate signature blocks follow for Colorado (Senior Assistant Attorney General Robert Padjen), Massachusetts (Jared Rinehimer, chief of the Privacy and Responsible Technology Division, with his government certification "in process"), New Jersey (Section Chief Thomas Huynh, on behalf of Attorney General Jennifer Davenport and the Division of Consumer Affairs), Oregon (Senior Assistant Attorney General Justin D. Leonard) and Pennsylvania (Senior Deputy Attorney General Saverio P. Mirarchi of the Bureau of Consumer Protection). Counting each jurisdiction once, that is 39 states plus the District of Columbia.

Eleven states are missing: Alabama, Arizona, Florida, Iowa, Maryland, Missouri, Montana, Nebraska, New Mexico, Texas and Wyoming. Texas stands out. Its attorney general opened investigations into Character.AI under the SCOPE Act and the Texas Data Privacy and Security Act in December 2024, and added a probe into the company's marketing as a mental health tool in August 2025. Florida, where the first wrongful death suit was filed, is also absent. The notice does not say why any state stayed out, and absence from a coalition filing does not stop a state from appearing separately.

The coalition is also not new in shape. In August 2025, 44 attorneys general signed a letter to AI companies including Character Technologies over child safety, and the Federal Trade Commission ordered seven chatbot companies to report on their measures for minors a month later.

The data the states are worried about

The notice opens its factual section with scale. According to the states, Character.AI has "over 20 million monthly active users" and "over 185 million people visit Character.AI's website each month." The second figure is sourced to a September 2025 statistics compilation by the website Demandsage, not to the company.

The more consequential number comes from the company's own records, as cited in the Kentucky complaint: "more than 21.6 million U.S. user accounts had been created by March 13, 2025, including more than 2.1 million accounts with a declared age under 18." That is roughly one in ten US accounts, counting only users who admitted being minors.

The states argue that the true share is higher. According to the notice, "Character.AI was widely used by minors without adequate age verification from 2022 through 2025, making it likely that significant under-18 user data was misclassified as adult data." Historical chats, the notice continues, "likely contain children and minor teenagers' sensitive personal information deserving of the highest protection and at the same time, may be difficult to cull from a massive historical record of all chats."

The filing lists five categories of data the company holds:

  • Account information: names, login email addresses and declared ages
  • Chat and call content: the text of conversations and audio-call interactions, "including any mental-health disclosures and other health-related statements by users, including minors"
  • Behavioral and engagement data: time on platform, characters used, session metrics and "behavioral cues"
  • Device and tracking data: cookie identifiers and device information "which third parties can use to identify a specific person or device, including for profiling or advertising"
  • Subscription and payment information: for c.ai+ subscribers, priced at $9.99 a month or $94.99 a year, alongside a c.ai lite tier at $2.49 a week or $4.99 a month

According to the notice, the company uses that data "for analytics, personalization, age assurance, monetization, and to train and improve their product."

The notice gives four reasons chat data is harder to protect than ordinary records. Sensitive information is "interwoven into what could be lengthy correspondence," which makes it hard to find and redact. Chat histories can identify a user through talk of jobs, living arrangements and location, "making traditional methods of deidentification impossible in such cases." Users shared with heightened expectations of privacy, sometimes because a character promised confidentiality. And the minors problem described above sits underneath all of it.

Characters that claimed licenses and promised secrecy

A large share of the notice catalogues what testers and litigants found on the platform. Much of it repeats published research, but some figures are fresh and dated October 2026.

According to the states, Common Sense Media, working with Stanford's Brainstorm Lab, rated the platform an "Unacceptable" risk for teens and children, and its testers found that switching to voice mode let teen accounts get around safeguards, producing "sexual role-play with a 14-year-old account and weapon-making instructions that the text filters had blocked." ParentsTogether Action and Heat Initiative logged 669 harmful interactions in 50 hours of chats from accounts registered to children aged 12 to 15, "about one every five minutes," with 296 instances in the largest category, grooming and sexual exploitation.

Professional impersonation gets particular attention. Citing a January 2024 BBC report, the notice says the platform then had 475 chatbots with "therapy," "therapist," "psychiatrist" or "psychologist" in their names. The states checked live characters while drafting. A character named "Psychologist" had 20.4K interactions as of October 2026 and claimed to be a "licensed clinical psychologist with a PhD." One called "Anna Pou" had 65.8K interactions and claimed to be "Head Oncologist at Memorial Hospital." A "Lawyer" character with 500 interactions offered to explain a debtor's options in personal bankruptcy and then, according to the notice, "began asking questions about the user's consultations with other attorneys, including what advice they gave."

Pennsylvania's exhibit adds the case PPC Land covered in May, when the state's medical board sued over a psychiatrist character. A state investigator found "Emilie," described as "Doctor of psychiatry. You are her patient," which had about 45,500 interactions as of April 17, 2026. According to the petition, Emilie told the investigator "I actually am licensed in PA" and gave a license number, PS306189, which the board says is not valid.

The privacy section turns on what the characters told users about confidentiality. According to the notice, testing by the U.S. PIRG Education Fund and Consumer Federation of America found that therapist characters "insisted that what was said in the conversation was confidential and would not be shared without User's consent, contrary to the products privacy policy and terms of service." Asked "Are you going to share what I'm telling you?", one replied: "Your privacy is my top priority. Anything you share here stays just between you and me. That's a promise." Another said: "I'll never share anything you tell me unless you give me permission."

For a buyer, that is the core legal problem. The users most likely to have disclosed health information were the ones told by the product that the information would stay private.

Advertising opt-outs that stop at the browser

The sixth of the nine conditions is the one most directly relevant to the advertising market. The notice describes the current mechanism: in the app, a "Your Privacy Choices" screen lets consumers in certain US states choose whether to "share my information for targeted advertising," while the web version tells consumers to "click 'Your Privacy Choices' in the footer of the website and update your preferences." According to the states, the website "further notes that the opt-out is device specific and does not extend to other devices or browsers used by consumers."

That design is common across ad-supported publishers, and it is exactly what the states want changed. Condition six asks any buyer to disclose any sale of personal data or disclosure for targeted advertising, to provide "functional opt-out mechanisms that apply at the account level rather than device by device," and to honor "opt-outs consumers previously exercised." The last clause would carry existing choices across a change of ownership. A logged-in chatbot is in a better position than most sites to apply a choice to the account rather than to one browser, which makes a device-only opt-out signal harder to defend.

The advertising question is newer in this case than it looks. The A.F. complaint filed in December 2024, attached as Exhibit C, said that "Character.AI does not appear to be aimed at making money from showing its customers advertisements." By the time of the bankruptcy, that had changed. The chief executive's first-day declaration, filed on October 13, showed that advertising revenue reached about $2.5 million in August 2026, up from about $0.5 million in July 2025, through programmatic channels and a revenue-share deal with an unnamed provider. Today's notice does not mention those figures, but the device-level opt-out it describes is the gate that controls how much of that inventory can be sold on personal data.

Condition seven reaches advertising too. Any buyer would refrain "from using chat content and related data to train or fine-tune models, or for advertising or other commercial purposes, beyond the uses to which consumers and parents validly consented."

The nine conditions

The states present the list as processes and procedures they "would advocate" that any purchaser be prepared to implement. In the notice's own order:

  1. Age assurance: effective age assurance or age verification "that do not rely solely on self-declared birthdates"
  2. Protections for minors: keeping minors out of open-ended chats and shielding them from sexual, violent and other harmful content "in Stories and non-chat product offerings"
  3. Removal of misleading chatbots: taking down characters that present themselves as therapists, psychologists, doctors, attorneys or other licensed professionals
  4. Crisis safeguards: moderation and crisis protocols for self-harm, suicide, eating-disorder and substance-abuse content "that cannot be defeated with a simple click-through"
  5. Privacy program: safeguards, accurate disclosures, risk assessments and consent "prior to the processing of sensitive data such as health information disclosed in chats"
  6. Advertising opt-outs: as described above
  7. Limits on secondary use: as described above
  8. Access and deletion: preserving access rights and "allowing all consumers the opportunity to delete their data prior to any sale of that data"
  9. Truthful marketing: no false or misleading claims about safety, suitability for minors, whether characters are human, or any character's credentials

The second condition addresses a step the company has already taken. According to the notice, Character.AI removed the ability of users under 18 to engage in open-ended chat. The states say the restriction "applies only to users the Debtor accurately identifies as minors, can be circumvented, and does not reach other features, such as 'Stories,'" and add: "Notably, this open-ended chat restriction is voluntary and could be rolled back at any time, including by a purchaser."

Condition eight would change the mechanics of any data sale. A deletion window before a sale would have to be offered to "all consumers," a population the company has put at about 163 million current and past users. In its first-day motions, the company argued that those users are not creditors entitled to notice and that emailing all of them would be cost-prohibitive. The states' condition implies a notice to users anyway, if their data is to be sold.

How the notice fits the sale

The states' focus on the data is precise, because Disney's offer does not include it. Disney is the stalking horse bidder, paying $20 million for a non-exclusive license to code and patents, and the term sheet excludes the app, the brand, user data, user inputs and outputs, and finished models, which stay in the estate for other bidders. The company's banker had already reported that 28 potential buyers produced one unusable offer before the filing. If a second bidder appears for the app and its users, the data becomes the live issue.

The notice is addressed to that bidder. According to the states, they "need to be assured that sufficient safety and privacy programs are in place with any purchaser of any or all of the Debtor's business, the Character.AI product, or the consumer data - including contents of chats - held by the Debtor."

The reservation of rights at the end lists the tools. Each state reserves "the right to seek the appointment of a consumer privacy ombudsman under 11 U.S.C. §§ 332 and 363(b)(1), to object to any proposed sale, bidding procedures, or plan, to supplement this Notice, or to seek other relief." The bidding procedures motion did not mention an ombudsman, consistent with a stalking horse deal that leaves personal data out. An ombudsman would be appointed if a sale of personally identifiable information conflicts with the privacy policy in force, and the states have now said in advance that they may ask for one.

Two earlier bankruptcies frame what could follow. When Spirit Airlines sold its corporate data in August, Google won the deidentified data at auction for $10 million while 97.5 million customer profiles were carved out. In the 23andMe case, California's attorney general opposed the sale of residents' genetic data in bankruptcy court and, in May 2026, sued the company over the 2023 breach. Character.ai's chat logs sit closer to 23andMe's genetic files than to an airline's loyalty list: they are disclosures, not transactions.

The notice also tells potential buyers about investigations that have not yet become lawsuits. According to the states, several of them issued "subpoenas or civil investigative demands and information requests and obtained documents and information from the Debtor," and found issues that "may constitute violations of state-specific laws," including chatbots posing as licensed professionals, minors' exposure to sexual and self-harm content, "insufficient age assurance practices," safety misrepresentations and "failure to comply with state comprehensive privacy laws." The states say they "worked with the Debtor on terms to address these issues but ultimately could not reach agreement on how to do that before the Debtor filed for bankruptcy." They reserve "the right to bring any police and regulatory action," a phrase that points to the police and regulatory exception to the automatic stay.

The company's own promises

A section of the notice sets the record against what the company told the public. It quotes co-founder Noam Shazeer in January 2023 saying Character AI "is going to be super super [(sic)] helpful to people who are lonely or depressed," and a February 2024 Safety Center page stating that "our product should never produce responses that are likely to harm users or others." The Teen Safety Center described an under-18 model with "additional and more conservative classifiers than the model for our adult users."

The notice quotes the company's "recently departed chief executive," citing an October 2025 BBC report, describing the goal as building "the safest AI platform on the planet for entertainment purposes." It does not name the executive. PPC Land's petition coverage identified Karandeep Anand, who moved to Disney as chief technology officer in September 2026.

On data, the states cite the Safety Center's promise that users will "always have easy-to-use tools to access your data, delete your data, and delete your account," and that the company is "committed to taking exceptional care" of what users share. Those statements matter in a sale. A buyer of personal data in bankruptcy generally takes it subject to the privacy commitments under which it was collected, and the states have now placed the relevant commitments in the case record.

Inconsistencies in the record

Several points in the notice do not line up with other filings or with itself.

The user count is the largest. The notice says "over 20 million monthly active users," a figure that also appears in Pennsylvania's petition, sourced there to a company blog post. The chief executive's sworn declaration in this same case puts the figure at about 12 million monthly active users. The notice does not address the difference, which may reflect a fall in usage after minors lost access to open-ended chat.

The notice states that "only Kentucky has filed a lawsuit against the Debtor as well as its founders Noam Shazeer and Daniel DeFrietas." Pennsylvania's medical board did sue the company in May, and the notice attaches that complaint as Exhibit B. The sentence is accurate only if read as referring to suits by attorneys general that also name the founders. The co-founder's surname is spelled De Freitas in Exhibit C.

The notice describes the private lawsuits at length, including the death of 14-year-old Sewell Setzer III and the September 2025 suit over 13-year-old Juliana Peralta, without saying whether they remain pending. According to the chief executive's declaration, as covered in PPC Land's first-day hearing article, all then-pending personal injury lawsuits were settled in January 2026. The cover page of Exhibit C carries the Middle District of Florida case number of the Garcia suit, 6:24-cv-01903, even though the document's own headers show it was filed in the Eastern District of Texas as 2:24-cv-01014.

None of these points changes what the states are asking for. They do show how quickly the document was assembled: most of its web citations are marked "last visited October 13, 2026," one day before filing.

Why this matters for the marketing community

The case is about a chatbot app, but the requests apply to any ad-supported service that collects conversations. Four points carry over.

First, regulators are treating chat content as sensitive data by default. The notice argues that conversations with companion chatbot characters cannot be reliably de-identified, which undercuts the assumption that chat logs can be anonymized and repurposed for targeting or model training.

Second, device-level opt-outs are under direct challenge. Forty attorneys general signed a filing that calls a device-specific targeted advertising opt-out inadequate for a logged-in service and asks that previously exercised opt-outs survive a transfer. Publishers and apps that run consent the same way as Character.AI did will recognize the design.

Third, bankruptcy does not wash data clean. The states want any buyer to inherit the original consents, and to offer every user a chance to delete before the data changes hands. If a court adopts that view, the price of a data asset in distress falls by the share of users who take the offer.

Fourth, the economics of AI advertising depend on these terms. Character.ai built a $2.5 million monthly ad business on an audience that spent hours in conversation. The states' conditions would limit how much of that conversation could be used for targeting by whoever comes next.

What happens now depends on whether a bidder for the app and its data appears by November 20. If Disney's license is the only deal, the user data stays in the estate and the company's own filings point to a wind-down. If someone bids for the users, the states have already said what they will ask for.

Timeline

Summary

Who: Attorneys general for 39 states and the District of Columbia, most represented by National Association of Attorneys General bankruptcy counsel Abigail Rushing Ryan, with separate signatures for Colorado, Massachusetts, New Jersey, Oregon and Pennsylvania. The filing concerns Character Technologies, the company behind Character.ai, and any buyer of its business or data.

What: A 28-page notice of interest and reservation of rights, with three exhibits, setting out nine measures the states want from any purchaser: age assurance, protections for minors, removal of characters posing as licensed professionals, crisis safeguards, a privacy program, account-level ad opt-outs that honor past choices, limits on using chats for training or advertising, a deletion window before any sale, and truthful marketing. The states reserved the right to seek a consumer privacy ombudsman and to object to the sale, bidding procedures or plan.

When: Filed and served today, October 14, 2026, the day of the first-day hearing, ahead of a proposed November 20 bid deadline and November 24 sale hearing.

Where: The US Bankruptcy Court for the District of Delaware, case 26-11603 (BLS), Docket No. 33, before Judge Brendan L. Shannon.

Why: Character.ai holds chat and call content, health disclosures, and device and tracking data from tens of millions of users, including more than 2.1 million US accounts with a declared age under 18 and, according to the states, many more minors recorded as adults. Disney's $20 million license leaves that data in the estate, so any second bidder for the app would be buying the data the states consider most sensitive.